CVE-2015-5346: XSS
Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.
Other sources
When recycling the Request object to use for a new request, the requestedSessionSSL field was not recycled. This meant that a session ID provided in the next request to be processed using the recycled Request object could be used when it should not have been. This gave the client the ability to control the session ID. In theory, this could have been used as part of a session fixation attack but it would have been hard to achieve as the attacker would not have been able to force the victim to use the 'correct' Request object. It was also necessary for at least one web application to be configured to use the SSL session ID as the HTTP session ID. This is not a common configuration.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5346?
CVE-2015-5346 is classified as a medium severity vulnerability due to its potential to allow remote session hijacking.
How do I fix CVE-2015-5346?
To mitigate CVE-2015-5346, upgrade Apache Tomcat to versions 7.0.67, 8.0.32, or 9.0.0.M2 or later.
Which versions of Apache Tomcat are affected by CVE-2015-5346?
CVE-2015-5346 affects Apache Tomcat versions 7.x prior to 7.0.66, 8.x prior to 8.0.30, and 9.x prior to 9.0.0.M2.
What types of attacks are possible with CVE-2015-5346?
CVE-2015-5346 allows attackers to hijack user sessions through session fixation attacks.
Is CVE-2015-5346 exploitable in all configurations of Tomcat?
CVE-2015-5346 is exploitable when different session settings are used for multiple deployments of the same web application.